A contractor's last day ends with a customer list copied to a USB drive and carried out the front door. Within a week the company has four new safeguards: a written rule banning removable media, a Group Policy setting that blocks USB storage on every laptop, a short training session on why the rule exists, and plastic port blockers on the kiosks in the lobby. All four aim at the same risk, and each one works in a completely different way.
Security+ expects you to tell those differences apart. On the CompTIA Security+ SY0-801 exam, control categories sit under objective 1.1, which expects you to explain security controls and sort them by how they are put into practice. This lesson covers the four categories, the alternate name CompTIA gives most of them, and a quick method for naming the category of any control a scenario describes.
A control's category describes how it is put into practice
A security control is any safeguard that reduces risk: a firewall rule, a fence, a policy, a trained receptionist. Security+ describes every control two ways. The category says how the control is implemented: by a system, by management, by people doing their jobs, or by something in the physical world. The type says what the control does relative to an incident, such as preventing, detecting or correcting it. Types are the subject of the next lesson; this one is about categories.
SY0-801 uses four categories, and three of them carry a second name you should recognize:
| Category | Also called | What carries it out |
|---|---|---|
| Technical | Logical | Hardware, software and firmware |
| Managerial | Administrative | Management decisions, plans and documents |
| Operational | (no alternate name) | People performing day-to-day security tasks |
| Physical | Environmental | Barriers, facilities and site conditions |
The terms echo older NIST guidance: the NIST control catalog, SP 800-53, once sorted its control families into management, operational and technical classes. CompTIA pulls physical controls out into a category of their own. You will also meet a three-category model in other frameworks and study material: administrative, technical and physical. In that model, policies, procedures and training all fall under administrative. Security+ splits that bucket in two, managerial for decisions and oversight and operational for the people who carry out the work.
A category describes the implementation, not the goal. The four USB safeguards share one goal, keeping customer data from leaving on removable media, and still land in four different categories. When a question asks for a category, set aside what the control protects and look at what actually does the work.
Technical controls are enforced by hardware, software and firmware
Technical controls, which CompTIA also calls logical controls, are built into systems. Once configured, they act on every request without a person deciding each time. Firewalls and router access control lists, encryption, multifactor authentication, endpoint detection and response (EDR) agents, intrusion detection and prevention systems, data loss prevention, file permissions and audit logging are all technical controls.
The USB block from the opening is a good example. An administrator sets this Group Policy once, and every domain-joined laptop enforces it after its next policy refresh:
Computer Configuration > Administrative Templates > System > Removable Storage Access
All Removable Storage classes: Deny all access Enabled
A person configured that setting, but that doesn't make it an operational control. What enforces the rule when a user plugs in a drive at 2 a.m. is the operating system, so the control is technical. The same reasoning applies to a firewall rule written by an engineer or an account lockout threshold chosen by a manager. Whoever set it up, the system enforces it.
Watch for the word logical. Logical access controls are permissions, group memberships, ACLs and authentication, which decide what an account can reach on a system. Physical access controls decide who can walk into a room. If an answer option says logical, read it as technical.
Technical controls are consistent, fast and good at leaving records. Their weakness is that they do exactly what they were configured to do. A firewall rule that allows TCP 3389 from the internet will let attackers reach RDP all day, and the firewall will report that everything is working.